Many nonprofit leaders are seeking a clear, ‘best practice’ approach to creating a business continuity plan for their organization. Preferably a simple, straightforward approach that won’t take too much time. Or too much effort. Or rock the boat.
This article offers three pathways to creating a BCP for your organization. But fair warning: the actual process of drafting a plan takes time, effort, and perseverance. If you need some support or steady guidance, consider purchasing our web application, My Business Continuity Plan (www.mybusinesscontinuityplan.org).
What You Need to Know about BCPs
A business continuity plan is a resource that helps you accomplish two vital tasks:
- Identify mission-critical functions or activities that must continue during a period of sub-optimal operations. You won’t be able to operate ‘normally’ if your building is inaccessible, your staff can’t get to their customary work stations, or your clients are facing unusual amounts of stress.
- Outline strategies and processes—essentially a roadmap—to support the orderly resumption of operations.
Now that you understand what a BCP should do, here are three possible ways to go about creating a BCP for your nonprofit.
Path #1 – Structure by Events
Structuring a BCP based on disruptive events—think hurricane, act of terrorism, power failure, COVID-19—is the most common way to build a BCP. A plan with this structure describes the steps and strategies an organization will take if one of these events occurs. What’s the downside?
First, things rarely turn out the way we expect they will. A Cat-5 hurricane may turn into a Cat-2. A novel coronavirus diagnosed on the other side of the planet could turn into a global, trillion-dollar event. Next, plans structured by events tend to be very duplicative: each section describes actions, people, roles, priorities, activities, and more that may overlap with the same strategies and functions used for another event. Finally, a plan structured by events includes the incidents we’ve experienced before or those we can envision. Every organization has now faced a situation—the global pandemic—that honestly, none of us previously imagined.
The upside of a BCP structured by events is that it is essentially a collection of mini plans that may feel highly relevant in the moment. Here’s a way to approach the development of a BCP structured by events.
List the highly disruptive events that could negatively impact your nonprofit. For example:
- Weather events: hurricanes, earthquakes, tornadoes, severe storms, landslides, winter storms, extreme heat, and flooding. (Hint: don’t include weather events that aren’t relevant to your location!)
- Accidents: fire, explosions, car/bus accidents
- Systems failures: power grid failure, septic failure, water main break, information system corruption
- Human events: terrorism, workplace violence, civil unrest, cyberterrorism
- Disease/health: pandemic, epidemic, outbreak
Create a one-page summary of key steps and strategies related to each type of disruptive event. Using a weather emergency for example: if your procedures are likely to be the same regardless of the ‘type’ of weather event, simplify with a one-pager covering all weather events. However, if your response to winter storms is entirely different from your response to a hurricane, you probably need separate summaries for each.
Consider whether it makes sense to create BCP ‘levels’ that correspond to the impact or potential impact of the disruptive event. For example:
Level 1: some systems, people, and functions are impacted; minor scaling back or shuttering of programs is necessary
Level 2: various systems, people, and functions are impacted; some programs and activities will need to be curtailed
Level 3: the entire agency is negatively impacted; only mission-critical programs and activities will continue; all other activities will be scaled back per this plan
Identify your chain of command and decision-making approach for the BCP. For example:
- The Crisis Team is responsible for determining whether the interruption is a Level 1, Level 2, or Level 3 event.
- Once a Level has been announced, the plans associated that Level will begin
- Executive Team members are responsible for keeping the Crisis Team apprised about the implementation of the BCP, including any difficulties their teams are experiencing
Create an Appendix with resources that will be helpful during a disruption. For example:
- Key points of contact for your facilities and systems
- Emergency services agencies and first responders
- Evacuation maps/diagrams
- Disaster/emergency kit contents lists
- Contact information for key personnel, especially those providing management and support during an interruption
Review and discuss the draft BCP with a diverse team! In The Art of an Idea, John Hunt writes that:
“Working with people of different backgrounds doesn’t just give the group a different point of view, it makes you reassess your own. This is extremely powerful because we’re all trapped in what we’ve previously learnt. And ‘previously learnt’, often means what we’ve previously been told. And that’s usually not true or entirely accurate.”
Here are some question prompts to make your discussion productive:
- Will we know what to do—and who will do it—based on the contents of this plan?
- Do we feel more confident—or more uncertain—about our resilience with this plan?
- What are the strengths of this plan?
- What are the weak points?
Path #2 – Structure by Function
Another way to develop a plan is to draw on your existing functions and departments and ask each functional team to develop a mini BCP. The upside of this approach is that it doesn’t pit functions and activities against each other: each function determines what its top priority is and how it will scale back during an interruption.
Consider creating a worksheet to help guide the BCP conversations of the functional teams. Here’s an example:
Function Name: Finance
|Mission-Critical Activity/Responsibility||Standard Operating Procedure||Actions if BCP Triggered|
|1. Payroll||Staff Accountant reports payroll weekly by uploading data to our external provider Payroll reports are reconciled bi-weekly||SAME Payroll reports are reconciled monthly|
|2. Payment of benefits, utilities, and other mission-critical vendors||AP team processes payments weekly, in-house||AP team switches to external processing provider for all critical payments; frequency of payments reduced to bi-weekly|
|3. Onboarding of new hires||Paperwork is processed upon hire||Hiring suspended|
|4. Cash Flow Forecasting||Forecasts are prepared every 90 days||Forecasts are prepared every two weeks|
|5. Funder reporting||Funder reports are prepared per their respective due dates||Request flexibility from funders; delay reporting as permitted|
|1. Updating of Finance and Accounting Manual||Complete one section of the manual each month||Postpone until after the disruption ends|
|2. Selection of a new financial management system||Complete vetting process for a minimum of 4 vendors by year-end||Postpone work until after the disruption ends|
|3. Redesign of Board Financial Dashboard||Due by the end of fiscal year||Postpone completion until after the disruption ends|
Bring representatives of the functional teams together to discuss their mini BCPs. Discuss the implications of the plans developed by the teams. Here are possible discussion questions for that gathering:
- As you review the mini BCPs of the other functions, what questions do you have?
- Are the lists of mission-critical responsibilities reasonable given the potential stress we will be under during a significant interruption? (think COVID-19 or an extreme weather event that forces our main offices to close)
- As you take another look at your plan, are there any activities you would move from one category to the other?
- Are the “Actions if BCP Triggered” plans reasonable? Sufficiently detailed?
Path #3 - Structure by Impact
One of the powerful lessons the NRMC team has learned from our three decades as risk advisors is that myriad risk events have similar and sometimes overlapping impacts. If you reflect on the resources and capabilities needed to deliver your mission, it’s not hard to see how very different events could negatively impact those resources. For example:
- A fire/explosion, tornado, pandemic, or power grid failure could make it impossible to work from your headquarters office.
- School closures due to extreme weather, a pandemic, or power event could make it impossible for your staff who are parents to work from the office
- A hurricane, severe storm, or pandemic could make it unsafe for your team to travel to and work from your headquarters
- Any disruptive event could make it difficult or impossible to access systems and resources housed in your primary facilities.
Here are a few possible steps to develop a BCP that is structured by the impacts of the disruption on your organization.
Form a small team to develop your BCP based on impacts. Make sure that your team includes participants with experience in all or most areas of activity in your nonprofit!
Identify the critical impacts of disruptive events. Consider using a chart or ‘cheat sheet’ to get the ideas flowing!
|Workplace violence||· Some/all staff are unable to work or work from customary locations · Client demands/needs may increase or decrease · Facilities or systems may be damaged and unusable · Extra supplies or materials may be needed · Essential systems (hardware, software, databases, etc.) may be damaged or offline · Negative sentiment from people and organizations that depend on our services · Media spotlight · And so on...|
|Power grid failure|
|Failure of transportation infrastructure|
|Third-party systems failure (e.g., AWS or Dropbox goes down)|
|Systems Breach (cybercriminals hijack our systems, e.g., denial of service, SQL injection)|
For each identified impact, brainstorm or ‘writestorm’* ideas to cope with that impact. Remember to examine potential strategies to resume operations as soon as practical. Consider using a chart or worksheet to support the process.
*writestorming is like brainstorming, except participants initially jot down their ideas instead of sharing them out loud. Once everyone has the prescribed number of ideas, the facilitator goes around the virtual or actual meeting room and asks each participant to share one idea. Additional sharing rounds continue until everyone has shared all of their ideas. Writestorming is especially helpful in groups where extroverts tend to dominate!
|IMPACT||Immediate Steps||Resumption Strategies|
|Some staff are unable to work from customary locations||Shift to ‘work from home’ mode for affected staff|
|All staff are unable to work from customary locations||All staff shift to ‘work from home’ mode and some staff my pivot to special projects to ensure flexibility for their work location|
|Client demands increase||Call on partner agencies and recently retired volunteers to assist|
|Client demands decrease||Identify 2-4 programs we can scale back or discontinue for 30-60-90 days|
|Facilities are damaged||Convene facilities team and contractors to identify a schedule for assessment and repairs; notify insurers; notify staff of implications|
|Systems are damaged or unusable||Use a secondary method (e.g., text alert app) to let staff know about the status of systems; convene IT team to develop a 5-10-20 day plans to repair or replace damaged systems|
|Extra supplies are needed||Use organization credit cards to purchase necessary supplies|
Bring the BCP team back together to identify the next steps. For example:
- Share the material created through the brainstorming exercise with the executive team
- Share the material created with the entire staff team; invite anonymous feedback and proposed changes by using a survey tool
- Ask each BCP team member to meet with their respective teams to share the results of the exercise and invite feedback
Implement the preferred next steps identified in Step 4 and focus on getting your BCP in shape and ready to use. For example, share the results of the exercise and the contents of the BCP with all internal stakeholders. Identify external stakeholders who would benefit from a knowledge of the plan. Choose a date or timeframe to review and update the plan, such as 12 months from the date it is adopted internally.
The Truth about Business Continuity Planning
There’s no one way or right way to develop a BCP for your nonprofit. The best news is that any plan you’ve created in advance of an interruption is likely to be helpful in the moment. Keep in mind that events are very unlikely to unfold as you imagine they will. Flexibility during a disruption is key to protecting your mission and keeping the momentum high for mission-critical activities. The most crucial next step is to get started. Don’t delay. Your mission and your community are too vital for your organization to be unprepared to act when the next disruption happens.